Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A potential HTML and link injection vulnerability exists in chrome://password-manager because the primary account email is rendered unescaped in an i18nAdvanced string template. A compromised network process can supply a maliciously crafted email address containing allowlisted markup, allowing an attacker to inject arbitrary links and spoof the user interface. This injected link can bypass standard navigation restriction handlers to open external phishing pages directly from the trusted WebUI.

Affected files:

• chrome/browser/resources/password_manager/passwords_section.ts
• chrome/browser/resources/password_manager/passwords_section.html

Estimated timestamp from git blame: 2023-04-21

Root Cause Analysis

In chrome/browser/resources/password_manager/passwords_section.ts (lines 290-303), the method computeImportPasswordsText_() constructs the empty-state invitation text for syncing users:

private computeImportPasswordsText_(): TrustedHTML {
  if (this.isAccountStoreUser) {
    return this.i18nAdvanced('emptyStateImportAccountStore');
  }
  if (this.isSyncingPasswords) {
    return this.i18nAdvanced('emptyStateImportSyncing', {
      substitutions: [
        this.i18n('localPasswordManager'),
        this.accountEmail,
      ],
    });
  }
  return this.i18nAdvanced('emptyStateImportDevice');
}

The accountEmail property is supplied directly as a raw substitution parameter to this.i18nAdvanced without any prior sanitization or HTML escaping (unlike other WebUI dialogs in the same directory, which use htmlEscape).

The resulting TrustedHTML is bound directly to the Polymer inner-h-t-m-l attribute of the #importPasswords div in chrome/browser/resources/password_manager/passwords_section.html (lines 45-48):

<div id='importPasswords' class='cr-secondary-text'
    hidden='[[!showImportPasswordsOption_(groups_, passwordManagerDisabled_)]]'
    inner-h-t-m-l='[[importPasswordsText_]]'>
</div>

i18nAdvanced delegates to sanitizeInnerHtml and parseHtmlSubset (ui/webui/resources/js/parse_html_subset.ts). The default element/attribute allowlist in parseHtmlSubset permits standard anchor elements (<a>) containing href values starting with https:// / # and target='_blank'.

Additionally, the click listener on #importPasswords is registered in updateImportPasswordsLink_() using querySelector('a') to only grab the first anchor element:

private updateImportPasswordsLink_() {
  const importLink = this.$.importPasswords.querySelector('a');
  assert(importLink);
  importLink.addEventListener('click', (event: Event) => {
    event.preventDefault();
    ...
  });
}

Because the translation template IDS_PASSWORD_MANAGER_UI_EMPTY_STATE_SYNCING_USERS places the $2 (email) placeholder before the legitimate ‘select a CSV file’ anchor link, prepending a dummy anchor like <a href='#'></a> within the injected email ensures the preventDefault() listener is attached to the dummy link, allowing secondary attacker-injected links to retain default navigation behavior and open external URLs when clicked.

Suggested Attack Flow (Potential Steps)

Note: These are potential steps; our tooling does not yet have the capability to execute code in a live environment.

1. A compromised network process intercepts requests to Google’s Gaia OAuth /userinfo endpoint for the signed-in primary account.
2. The network process overrides the JSON body of the response to keep the legitimate GAIA ID/subject but returns a crafted email address containing allowlisted markup: 'email': '<a href=\'#\'></a><a href=\'https://attacker.example/verify\' target=\'_blank\'><b>Verify your Google account</b></a>'
3. The browser process receives and stores this email string verbatim within AccountTrackerService / AccountInfo (components/signin/internal/identity_manager/account_tracker_service.cc:299).
4. The SyncHandler propagates this updated email to the chrome://password-manager WebUI via stored-accounts-changed (chrome/browser/ui/webui/password_manager/sync_handler.cc:263).
5. When a password-syncing user with an empty credential vault navigates to chrome://password-manager, computeImportPasswordsText_() interpolates the raw payload.
6. The parser preserves the anchor tag, and the WebUI renders the fully styled, trusted-looking link inside the privileged page.
7. When the user clicks ‘Verify your Google account’, the page navigates directly to https://attacker.example in a new tab.

Suggested Remediation

To remediate this potential vulnerability, the account email must be HTML-escaped before being supplied as a substitution parameter to i18nAdvanced.

Import htmlEscape from chrome://resources/js/util.js and wrap this.accountEmail inside computeImportPasswordsText_():

import {htmlEscape} from 'chrome://resources/js/util.js';

// ...

private computeImportPasswordsText_(): TrustedHTML {
  if (this.isAccountStoreUser) {
    return this.i18nAdvanced('emptyStateImportAccountStore');
  }
  if (this.isSyncingPasswords) {
    return this.i18nAdvanced('emptyStateImportSyncing', {
      substitutions: [
        this.i18n('localPasswordManager'),
        htmlEscape(this.accountEmail), // <-- Safe substitution
      ],
    });
  }
  return this.i18nAdvanced('emptyStateImportDevice');
}

Evaluated with Chrome root at commit: b2fea2e31df308d0f04e4ae47def4c4f939ee141

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.